System and method for traffic-based computing interface misconfiguration detection

Abstract

A system and method for traffic-based misconfiguration detection. A method includes analyzing a first set of computing interface traffic data to identify types of data included among traffic to and from a computing interface; creating at least one computing interface schema based on the analysis, wherein each computing interface schema defines a plurality of schema fields and a plurality of corresponding schema values, wherein each schema value indicates a normal behavior for the computing interface with respect to the corresponding schema field; and identifying a misconfiguration of the computing interface based on the at least one computing interface schema and a second set of computing interface traffic data.

What is claimed is: 
     
         1 . A method for traffic-based misconfiguration detection, comprising:
 analyzing a first set of computing interface traffic data to identify types of data included among traffic to and from a computing interface;   creating at least one computing interface schema based on the analysis, wherein each computing interface schema defines a plurality of schema fields and a plurality of corresponding schema values, wherein each schema value indicates a normal behavior for the computing interface with respect to the corresponding schema field; and   identifying a misconfiguration of the computing interface based on the at least one computing interface schema and a second set of computing interface traffic data.   
     
     
         2 . The method of  claim 1 , further comprising:
 performing at least one mitigation action with respect to the computing interface based on the identified misconfiguration.   
     
     
         3 . The method of  claim 1 , wherein the at least one computing interface schema includes at least one request schema and at least one response schema. 
     
     
         4 . The method of  claim 1 , wherein at least one of the first set of computing interface traffic data and the second set of computing interface traffic data includes duplicated traffic. 
     
     
         5 . The method of  claim 4 , wherein the duplicated traffic is created based on data extracted from a communications session by building at least one of a plurality of communication protocol layers based on data extracted from other layers of the plurality of communication protocol layers. 
     
     
         6 . The method of  claim 1 , wherein the plurality of schema fields for each computing interface schema includes at least one field having a predetermined optional marker indicating that the respective schema field is optionally included in any given request or response of traffic to and from the computing interface. 
     
     
         7 . The method of  claim 1 , wherein the misconfiguration is identified based further on at least one predetermined kind of protected data for which additional precautions are required. 
     
     
         8 . The method of  claim 7 , wherein each of the at least one computing interface schema includes a first schema value for a corresponding first schema field representing authentication status, wherein the identified misconfiguration is based on a combination of the first schema value for one of the at least one computing interface schema indicating a lack of required authentication and a portion of the second set of computing interface traffic data including one of the at least one predetermined kind of protected data. 
     
     
         9 . The method of  claim 1 , further comprising:
 duplicating traffic to and from a computing interface, wherein duplicating the traffic includes extracting data from a plurality of communication protocol layers used for communications with the computing interface, wherein the first set of computing interface traffic data includes the duplicated traffic.   
     
     
         10 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
 analyzing a first set of computing interface traffic data to identify types of data included among traffic to and from a computing interface;   creating at least one computing interface schema based on the analysis, wherein each computing interface schema defines a plurality of schema fields and a plurality of corresponding schema values, wherein each schema value indicates a normal behavior for the computing interface with respect to the corresponding schema field; and   identifying a misconfiguration of the computing interface based on the at least one computing interface schema and a second set of computing interface traffic data.   
     
     
         11 . A system for traffic-based misconfiguration detection, comprising:
 a processing circuitry; and   a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:   analyze a first set of computing interface traffic data to identify types of data included among traffic to and from a computing interface;   create at least one computing interface schema based on the analysis, wherein each computing interface schema defines a plurality of schema fields and a plurality of corresponding schema values, wherein each schema value indicates a normal behavior for the computing interface with respect to the corresponding schema field; and   identify a misconfiguration of the computing interface based on the at least one computing interface schema and a second set of computing interface traffic data.   
     
     
         12 . The system of  claim 11 , wherein the system is further configured to:
 perform at least one mitigation action with respect to the computing interface based on the identified misconfiguration.   
     
     
         13 . The system of  claim 11 , wherein the at least one computing interface schema includes at least one request schema and at least one response schema. 
     
     
         14 . The system of  claim 11 , wherein at least one of the first set of computing interface traffic data and the second set of computing interface traffic data includes duplicated traffic. 
     
     
         15 . The system of  claim 14 , wherein the duplicated traffic is created based on data extracted from a communications session by building at least one of a plurality of communication protocol layers based on data extracted from other layers of the plurality of communication protocol layers. 
     
     
         16 . The system of  claim 11 , wherein the plurality of schema fields for each computing interface schema includes at least one field having a predetermined optional marker indicating that the respective schema field is optionally included in any given request or response of traffic to and from the computing interface. 
     
     
         17 . The system of  claim 11 , wherein the misconfiguration is identified based further on at least one predetermined kind of protected data for which additional precautions are required. 
     
     
         18 . The system of  claim 17 , wherein each of the at least one computing interface schema includes a first schema value for a corresponding first schema field representing authentication status, wherein the identified misconfiguration is based on a combination of the first schema value for one of the at least one computing interface schema indicating a lack of required authentication and a portion of the second set of computing interface traffic data including one of the at least one predetermined kind of protected data. 
     
     
         19 . The system of  claim 11 , wherein the system is further configured to:
 duplicating traffic to and from a computing interface, wherein duplicating the traffic includes extracting data from a plurality of communication protocol layers used for communications with the computing interface, wherein the first set of computing interface traffic data includes the duplicated traffic.